Multilevel Passenger Screening Strategies for

Multilevel Passenger Screening Strategies for Aviation Security Systems Laura A. McLay and Sheldon H. Jacobson Department of Mechanical and Industrial Engineering University of Illinois at Urbana-Champaign John E. Kobza Department of Industrial Engineering Texas Tech University Abstract

Passenger prescreening is a critical component of aviation security. This paper introduces the Multilevel Allocation Problem (MAP), which models the screening of passengers and baggage in a multilevel aviation security system. A passenger is screened by one of several classes, each of which corresponds to a set of procedures using security screening devices, where passengers are differentiated by their perceived risk levels. Each class is defined in terms of its fixed cost (the overhead costs), its marginal cost (the additional cost to screen a passenger), and its security level. The objective of MAP is to assign each passenger to a class such that the total security is maximized subject to passenger assignments and budget constraints. This paper shows that MAP is NP-hard, introduces two dynamic programming algorithms for solving MAP in pseudo-polynomial time, and introduces a Greedy heuristic that obtains approximate solutions to MAP that use no more than two classes. Examples are constructed using data extracted from the Official Airline Guide (OAG). Analysis of the examples suggests that fewer security classes for passenger screening may be more effective and that using passenger risk information can lead to more effective security screening strategies. Keywords: aviation security, policy modeling, integer programming, heuristics, dynamic programming.

Introduction On September 11, 2001, four commercial aircraft were hijacked and used as bombs to destroy the World Trade Center twin towers and inflict severe damage to the Pentagon. These acts of violence have lead to widespread aviation security policy and operational 1

changes throughout the nation’s airports. A critical component in aviation security systems is the prescreening of passengers with their checked and carry-on baggage prior to boarding an aircraft. However, developing strategies to effectively and efficiently screen passengers, as well as the allocation and utilization of screening devices, can be quite challenging. Moreover, even after such systems are in place, it can be very difficult to measure their effectiveness. Aviation security operations in the United States began in 1970 with surveillance equipment in airports in response to hijacking attempts. When hijacking attempts persisted, air carriers were required to physically screen all passengers with metal detectors (beginning in December 1972), with passenger prescreening operations not significantly changing from that time until 1996 (National Research Council 1996). The Commission on Aviation Safety and Security, established on July 25, 1996 and headed by (then) Vice-President Al Gore, recommended that the aviation industry improve security using existing explosive detection technologies, automated passenger prescreening, and positive passenger-baggage matching. Moreover, the Federal Aviation Administration (FAA) had been working with the airlines to annually purchase and deploy explosive detection systems (EDSs) at airports throughout the United States. From 1998 until September 11, 2001, EDSs were only used to screen checked baggage of selectee passengers, those who were not cleared by a computer risk assessment system (i.e., the Computer-Aided Passenger Prescreening System—CAPPS) developed in conjunction with the FAA, Northwest Airlines, and the United States Department of Justice. The checked baggage of nonselectee passengers, those who were cleared by such a system, received no additional security attention. There were no further differences between selectee and nonselectee passengers. The terrorist events on September 11, 2001 prompted the Inspector General for the United States Department of Transportation to prescribe additional security procedures to be implemented (Mead 2002; Mead 2003), including screening all checked baggage for explosives. Given such a policy, there would no longer be any distinction between selectee and nonselectee passengers, since all checked baggage would be screened. An FAA official once remarked that the FAA is in “...hot pursuit of equipment and procedures that can spot these [explosive] devices with high degrees of confidence for the nearly one billion pieces of [baggage] and 500 million passengers traveling annually on 2

United States carriers” (Malotky 1994). Note that in 2000, there were over 600 million passengers, with forecasts of nearly one billion passengers by 2013 (FAA 2002). The primary objective of all these efforts is to improve security operations at all of the nation’s airports. To meet this objective, the Transportation and Security Administration (TSA), part of the Department of Homeland Security, must develop new security system paradigms that can optimally use and simultaneously coordinate several security technologies and procedures. Aviation security devices deployed at airport stations (e.g., terminals) provide a level of security for passengers, and determining the type of security devices to deploy can be challenging. Moreover, once such devices are deployed, the practical issue of determining how to optimally use them can be difficult. Alternatively, experts suggest that greater scrutiny of passengers perceived as greater risks (from a security standpoint) is a more effective approach to aviation security. Butler and Poole (2002) suggest that the TSA’s policy of 100% checked baggage screening is not cost-effective and that enhancing the binary screening paradigm to a multilevel screening system would be a more effective approach to process airline passengers. Poole and Passantino (2003) endorse risk-based airport security, partitioning passenger and baggage security devices in proportion to perceived risk. They suggest that multiple levels of security for processing passengers may be more effective than treating all passengers the same (from a security standpoint). The TSA responded to these proposals through the development of CAPPS II, an enhanced computer-based system for systematically prescreening passengers. CAPPS II partitions passengers into three risk classes (as opposed to two classes by CAPPS). A frequently mentioned criticism of any system designed to classify passengers into risk classes, including CAPPS and CAPPS II, is that such systems can be gamed through extensive trial and error sampling by a variety of passengers through the system (Barnett 2001; Chakrabarti and Strauss 2003). Martonosi and Barnett (2003) note that trial and error sampling may not increase the probability of a successful attack and that CAPPS II may not substantially improve aviation security if the screening procedures for each type of passenger are not effective. Barnett (2004) suggests that CAPPS II may only improve aviation security under a particular set of circumstances and recommends that CAPPS II be transitioned from a security centerpiece to one of many components in future aviation security strategies. On July 14, 2004, the TSA announced that CAPPS 3

II has been dismantled over privacy concerns despite having invested $100M for its development (Hall and DeLollis, 2004). However, it appears that the TSA plans to replace CAPPS II with an automated system akin to CAPPS II (i.e., a system designed to partition passengers into risk classes) for passenger prescreening (Singer 2004). This paper describes a systematic approach for designing an enhanced passenger screening system using discrete optimization models and algorithms, by formulating a problem that models multilevel passenger prescreening strategies. Multilevel screening considers no fewer than three levels of security to screen passengers, as opposed to the binary system in place prior to September 11, 2001. Therefore, the primary contribution of this effort is to identify models for designing multilevel screening security systems, and show how these models can be used to provide insights into the operation and performance of such systems. Note that this research assumes that a system such as CAPPS has been implemented and is highly effective in identifying passenger risk (TSA 2003a) . The following definitions are needed to describe these models. An attack is any event in which willful human intent disrupts air service. A threat is a passenger or baggage directly involved in a planned attack targeted at an aircraft. For example, hijackers and terrorists with bombs in their checked baggage are threats. A device is an aviation security technology and/or procedure used to identify a threat. Examples of devices include metal detectors, EDS devices, and detailed hand search by an airport security official. A class is defined by a preassigned subset of devices and a procedure through which passengers are processed prior to boarding an aircraft. A risk assessment system, such as CAPPS, assigns each passenger an assessed threat value, which quantifies the risk associated with the characteristics of the passenger. The fixed cost of a class is the purchase and overhead costs for the devices associated with the class. Note that the fixed cost of a class is assessed against the budget only if there are passengers assigned to the class. The marginal cost associated with a class is the direct cost to screen each passenger or bag assigned to the class. These values may be acquired or estimated from statements and press releases given by the TSA and published articles on aviation security in the public domain. Secondary screening is needed to resolve alarms in each class. In practice, the same secondary screening procedures may be used to resolve alarms in all of the classes, which 4

suggests a degree of overlap between the classes. However, this research focuses on the primary screening procedures associated with each class, and it assumes that there are enough resources for resolving alarms. Hilkevitch (2003) describes the secondary screening procedures used at Heathrow International Airport in London. Several articles formulate aviation security problems as integer programming and discrete optimization models. Jacobson et al. (2001) provide a framework for measuring the effectiveness of a baggage screening security device deployment at a particular station. Jacobson et al. (2002) introduce three performance measures for baggage screening security systems and use these models to assess the security effect for single or multiple stations. Jacobson et al. (2005) formulate problems that model multiple sets of flights originating from multiple stations subject to a finite amount of resources. These problems consider three performance measures, and examples suggest that one of the performance measures may provide more robust screening device allocations. Virta et al. (2002) consider the impact of originating and transferring passengers on the effectiveness of baggage screening security systems. In particular, they consider classifying selectees into two types; those at their point of origin and those transferring. This is noteworthy since at least two of the hijackers on September 11, 2001 were transferring passengers. Other research has focused on the experimental and statistical analysis of risk and security procedures on aircraft. For example, Barnett et al. (2001) performed a largescale two-week experiment at the nation’s airports to test which costs and disruptions would arise from using positive passenger baggage matching (PPBM), an aviation security procedure, for all flights. Barnett et al. (1979) and Barnett and Higgins (1989) study mortality rates on passenger aircraft and perform a statistical analysis on this data. The paper is organized as follows. Section 2 introduces the Multilevel Allocation Problem (MAP), a discrete optimization model that considers budget allocation based on class costs and shows that this problem is NP-hard. Section 3 introduces a heuristic that provides approximate solutions to MAP, and describes two dynamic programming algorithms that solve MAP in pseudo-polynomial time. Section 4 provides a real-world example using data extracted from the Official Airline Guide (OAG). Section 5 provides concluding comments and directions for future research. The Appendix contains the 5

proofs of the theorems and lemmas. A companion paper analyzes theoretical aspects of MAP as it is formulated as a knapsack problem (McLay and Jacobson 2003).

1

Discrete Optimization Model

This section introduces the Multilevel Allocation Problem (MAP), a general framework for multilevel security screening, and formulates it as a discrete optimization problem. MAP is first stated as an optimization problem and then formulated as an integer programming model. The objective is to assign N passengers to M classes such that the total security is maximized subject to budget and assignment constraints. The classes are defined in terms of their fixed and marginal costs, which are determined by the set of devices that define the classes. Although this problem assigns passengers to classes, it ultimately determines how the budget should be allocated to the various classes and which classes should (and should not) be used. MAP is formally stated. The Multilevel Allocation Problem (MAP) Given: A set of N passengers, each of which is characterized by an assessed threat value AT1 , AT2 , . . . , ATN with 0 < ATi ≤ 1, i = 1, 2, . . . , N , a set of M classes, a fixed cost associated with each class F C1 , F C2 , . . . , F CM , a marginal cost associated with each class M C1 , M C2 , . . . , M CM , the total budget B, the security level of each class, Li , where 0 ≤ Li ≤ 1, i = 1, 2, . . . , M . Denote passenger assignments for the N passengers to the M classes by A1 , A2 , . . . , AM , where Ai ⊆ {1, 2, . . . , N } represents the subset of passengers who are assigned to class i, and define the risk level Ri of class i = 1, 2, . . . , M as the proportion of assessed threat values of the passengers assigned to class i. Hence, X 1 Ri = PN ATj , i = 1, 2, . . . , M (1) j=1 ATj j∈Ai S

Find passenger assignments A1 , A2 , . . . , AM such that M i=1 Ai = {1, 2, . . . , N } and Ai1 ∩ Ai2 = ∅ for i1 , i2 = 1, 2, . . . , M , i1 6= i2 , and such that the budget constraint is satisfied P P (i.e., M i=1 |Ai | M Ci + {i:|Ai |>0} F Ci ≤ B) and the total security is maximized (i.e., PM i=1 Li Ri ). The assessed threat values, the security levels and the risk levels can be set with information and data available from CAPPS and the TSA. The assessed threat values provide risk assessment measures for each passenger (scaled between zero and one). It is 6

assumed that the assessed threat values are accurate representations of the passengers’ true level of risk (i.e., passengers with higher assessed threat values are more likely to be a threat than passengers with lower assessed threat values). Another way to interpret passenger risk is to base the assessed threat values on passenger and baggage attributes (e.g., a checked bag having a large amount of metal shielding has a larger assessed threat value than a bag without shielding), and hence, the assessed threat values are assigned as passengers check in for their flights. The security level of each class (scaled between zero and one) is based on security procedures of each device used to screen passengers in that class. In this case, the security level for class i is defined as the true alarm rate, the probability that a passenger who is a threat is detected given that they are assigned to class i. Likewise, the risk level for class i is defined as the conditional probability that class i contains a passenger who is a threat given that the passenger population contains a passenger who is a threat. In order for the risk levels to be interpreted as this conditional probability, each assessed threat value must be proportional to the probability that the passenger is a threat. The total security is then the overall true alarm rate, the probability that a threat is detected given that there is a passenger who is a threat. To see this, define the following events: D = a threat is detected in the passenger population, T = the passenger population contains a threat, Ci = class i contains a passenger who is a threat, i = 1, 2, . . . , M . By conditioning on which class contains a threat, the total security can be expressed as P (D|T ) =

M X

P (D|Ci , T ) P (Ci |T ) =

i=1

M X

Li Ri .

i=1

Since each of the passengers in class i are screened individually, Li is the probability of detecting a class i passenger who is a threat. It is a function of the detection probabilities associated with the devices and the procedures used to screen passengers in class i. MAP is formulated as an integer program (2) with binary decision variables xij = 1(0) if passenger j is (not) assigned to class i for i = 1, 2, . . . , M , j = 1, 2, . . . , N , and yi = 1(0) if there is (not) at least one passenger assigned to class i = 1, 2, . . . , M .

max

M X i=1

Li Ri =

PN

1

M X N X

j=1 ATj i=1 j=1

Li ATj xij

7

(2)

subject to

M X N X

M Ci xij +

i=1 j=1 M X

M X

F Ci yi ≤ B

i=1

xij = 1, j = 1, 2, . . . , N

i=1 N 1 X xij − yi ≤ 0, i = 1, 2, . . . , M N j=1

yi ∈ {0, 1}, i = 1, 2, . . . , M xij ∈ {0, 1}, i = 1, 2, . . . , M, j = 1, 2, . . . , N. In (2), the objective is to maximize the total security, which is represented by the sum of the products of the security and risk levels. The first constraint is the budget feasibility constraint. The second set of N constraints ensures that each passenger is assigned to exactly one class. The third set of M constraints ensures that the fixed costs are included for all nonempty classes. The last two sets of M (1 + N ) constraints restrict the yi and xij to being 0-1 binary variables. Theorem 1 shows that MAP is NP-hard. Theorem 1: MAP is NP-hard. Note that MAP can be restricted in several ways and still remain NP-hard. First, since the polynomial Turing reduction considered fixed costs of zeros, MAP remains NP-hard when F Ci = 0, i = 1, 2, . . . , M . Secondly, MAP remains NP-hard when the assessed threat values for all passengers are identical (i.e., when passengers are indistinguishable). Since Theorem 1 shows MAP is NP-hard for a particular risk level form, MAP remains NP-hard for general risk level forms R1 , R2 , . . . , RM . However, when M = 2, MAP is solvable in polynomial time (see Lemma 3 in Section 3.1).

2

Heuristics and Dynamic Programming

This section introduces a Greedy heuristic, the Two Class Greedy Heuristic, that obtains approximate solutions to MAP in polynomial time, and two dynamic programming algorithms that obtain optimal solutions to MAP in pseudo-polynomial time. Without loss of generality, assume that AT1 ≤ AT2 ≤ . . . ≤ ATN and L1 ≤ L2 ≤ . . . ≤ LM . The heuristics and algorithms find the number of passengers assigned to each class and then construct the exact passenger assignments. Lemma 1 indicates that for any 8

feasible solution to MAP, the passengers with higher assessed threat values are assigned to classes with higher security levels. Therefore, if nM passengers are assigned to class M, the class with the highest security level, then the nM passengers with the largest assessed threat values are assigned to class M. Lemma 2 shows that MAP is polynomial solvable for a fixed number of classes. Lemma 1: Given an instance of MAP with AT1 ≤ AT2 ≤ . . . ≤ ATN and L1 ≤ L2 ≤ . . . ≤ LM , the optimal way to assign the N passengers to the M classes given that ni passengers are assigned to class i = 1, 2, . . . , M is to assign the first n1 passengers to class 1, the next n2 passengers to class 2, until the last nM passengers are assigned to class M. Lemma 2: MAP is polynomial solvable when there are a fixed number of classes (i.e., M is fixed).

2.1

The Two Class Greedy Heuristic

The Two Class Greedy Heuristic (2GH) obtains the solution to MAP with the highest +

objective function value using no more than two classes. To describe 2GH, let C N =

n

j

i:

B−F Ci M Ci

k

o

≥ N , the subset of classes such that the budget is sufficiently large for −

n

each class to screen all N passengers, and let C N = i : subset of classes. Note that C N

−

and C N

+

j

B−F Ci M Ci

k

o

< N , the remaining

are mutually exclusive and exhaustive

subsets of {1, 2, . . . , M }. Two trivial special cases are C N

+

= ∅, when there is no

feasible solution (i.e., the budget is not large enough to assign all N passengers to the M classes), and C N

−

= ∅, when the optimal solution value is equal to the largest

security level (i.e., the budget is sufficient to assign all N passengers to the class with the largest security level). To find the solution to MAP with the highest objective function value using no more than two classes, 2GH selects the solution from a set of candidate solutions with the highest objective function value. The candidate solutions are selected from the set of feasible solutions to MAP, where the remaining (non-candidate) feasible solutions can be pruned by assigning individual passengers to classes (see Lemma 1). The set of candidate solutions are obtained as follows: 2GH begins by partitioning the classes into C N

−

and C N

+

and finding the best solution using a single class. The optimal

solution using exactly one class assigns all N passengers to the class in C N 9

+

with the

largest security level. 2GH then obtains candidate solutions by considering solutions using exactly two classes, with one class in C N

−

+

and one in C N , where each such

pair of classes results in at most one candidate solution. The best solution using classes +

−

i+ ∈ C N and i− ∈ C N assigns the maximum number of passengers into the class with the highest security level such that the assignment and budget constraints are satisfied (i.e., the solution is feasible). Once the number of passengers assigned to each class is known, individual passengers are assigned to the two classes (see Lemma 1). Only classes i− ∈ C N

−

and i+ ∈ C N

+

such that Li+ < Li− need to be considered; otherwise

the resulting solutions would be no better than the best solution using a single class. In the 2GH pseudo-code, zh is the current best objective function value, the vector x of length M N is its associated passenger assignment, and Bh is the interim cost of this passenger assignment. For each candidate solution considered, zh0 is the objective function value, bni− c and dni+ e are the number of passengers assigned to i− ∈ C N

−

+

and i+ ∈ C N , respectively, and the vector x0 is the passenger assignment. 2GH executes in O(max{N log N, M 2 N }) time. The initial sorting of the assessed threat values and the partitioning of the classes into C N

+

and C N

−

requires O(M +

N log N ) time. Note that 2GH considers all combinations of two classes such that one of these classes is in C N −

+

−

and the other class is in C N . Therefore, 2GH obtains

+

|C N | |C N | ≤ M 2 candidate solutions in the worst case, and requires O(N ) time to compute the objective function value for each candidate solution. If the assessed threat values are identical, then 2GH obtains a solution in O(M 2 ) time since the assessed threat values do not need to be sorted and the objective function values are computed in constant time. Lemma 3 states that 2GH finds an optimal solution to MAP when there are two classes (i.e., M = 2). Theorem 2 applies only to the particular case of MAP when passengers are indistinguishable. Theorem 2 shows that in this case, 2GH always obtains solutions which are at least 1/2 of the optimal objective function value. Lemma 3: MAP is polynomial solvable when there are two classes. Theorem 2: 2GH always obtains solutions to MAP that are at least 1/2 of the optimal solution value when passengers have identical assessed threat values.

10

algorithm 1 The Two Class Greedy Heuristic procedure 2GH Sort assessed threat values such that AT1 ≤ AT2 ≤ . . . ≤ ATN − + Partition the set of classes into C N and C N + zh = max{Li : i ∈ C N } xij = 0, i = 2, . . . , M, j = 1, 2, . . . , N ; xC + j = 1, j = 1, 2, . . . , N 1 Bh = N · M CC + + F CC + 1

+

1

−

for all i+ = C N , i− = C N do Solve the linear equations: (1) (M Ci+ )n+ + (M Ci− )n− = B − F Ci+ − F Ci− (2) n+ + n− = N if 0 < n− < N then compute zh0 , x0 based on putting the dn+ e passengers with the lowest AT values in class i+ and the remaining bn− c passengers with the highest AT values in class i− if zh0 > zh then zh = zh0 , x ← x0 Bh = F Ci+ + F Ci− + dn+ eM Ci+ + bn− cM Ci− end if end if end for return x, zh , Bh end procedure

2.2

Dynamic Programming

This section introduces two dynamic programming algorithms which obtain optimal solutions to MAP in pseudo-polynomial time. For both algorithms, the passengers are sorted such that AT1 ≤ AT2 ≤ . . . ≤ ATN and the security levels are sorted such that L1 ≤ L2 ≤ . . . ≤ LM . This ensures that the dynamic programming algorithms assign the passengers with the highest assessed threat values to the (nonempty) class with the largest security level (see Lemma 1). These dynamic programming algorithms assume that the marginal costs, the fixed costs, and the budget assume values that are multiples of a base unit α. For example, the costs may be defined in multiples of $10, which results in α = 10. Moreover, ˆ may only take on a set of β discrete values such that the intermediate budgets B ˆ = α, 2α, . . . , βα = B, where the recursion cannot consider other intermediate budget B ˆ = 1, 2, . . . , β = B. values. Note that if α = 1, then β = B in the worst case, hence B ˆ denote To describe the first dynamic programming algorithm for MAP, let gm,n (B) the optimal solution to the problem defined over the first m = 1, 2, . . . , M classes, and 11

ˆ = α1 , α2 , . . . , αβ = B, n = 1, 2, . . . , N passengers, with budget B  

¯ ¯X n m X ¯ m X ˆ ˆ Li ATj xi,j ¯¯ M Ci xi,j + F Ci yi ≤ B; gm,n (B) = max PN  AT ¯ j j=1 i=1 j=1 i=1 j=1 i=1  n m  X 1 X m X n X

1

xi,j = 1, j = 1, 2, . . . , n;

i=1

N

xi,j − yi ≤ 0, i = 1, 2, . . . , m , 

j=1

where xi,j ∈ {0, 1}, i = 1, 2, . . . , m, j = 1, 2, . . . , n and yi ∈ {0, 1}, i = 1, 2, . . . , m. ˆ = L1 The optimal solution of MAP is given by gM,N (B). Initially, g1,n (B)

Pn

j=1 ATj

if

ˆ and −∞ otherwise, B ˆ = α1 , α2 , . . . , αβ , n = 1, 2, . . . , N . Subsequent F C1 + M C1 n ≤ B ˆ are found by the recursion values of gm,n (B) ˆ = max gm,n (B)

   gm−1,n (B), ˆ

 ˆ −F Cm −M Cm t)+Lm Pn  maxt=1,2,...,T {gm−1,n−t (B j=n−t+1 ATj }

ˆ

Cm where T = min{n, b B−F M Cm c}. At each step of the recursion, either no passengers are

assigned to class m, in which case the fixed cost is not assessed against the budget, or between 1 and T unassigned passengers with the highest assessed threat values are ˆ

Cm assigned to class m. Since b B−F M Cm c = N in the worst case, each step in the recursion

can call at most N other recursions and the recursion is called at most M N β other times, resulting in a total time bound of O(N 2 M B) in the worst case. Storing the ˆ requires space bound O(M N B). values of gm,n (B) ˆ be defined as To describe the second dynamic programming algorithm, let gm,n (B) ˆ m = 1, 2, . . . , M, n = 1, 2, . . . , N, B ˆ = α1 , α2 , . . . , αβ = B be before, and let fm,n (B), ˆ given that the optimal solution over the first m classes and n passengers with budget B at least one passenger is assigned to class m: ˆ = fm,n (B)

 

¯ ¯X X ¯ m n−1 max PN Li ATj xi,j + Lm ATn ¯¯ M Ci xi,j +  ¯ i=1 j=1 j=1 ATj i=1 j=1

m−1 X

1

m n−1 X X

ˆ − F Cm − M Cm ; F Ci yi ≤ B

i=1

m X i=1

xi,j = 1, j = 1, 2, . . . , n − 1; 

 X 1 n−1 xi,j − yi ≤ 0, i = 1, 2, . . . , m − 1  N j=1

with xi,j ∈ {0, 1}, i = 1, 2, . . . , m, j = 1, 2, . . . , n − 1 and yi ∈ {0, 1}, i = 1, 2, . . . , m − 1. ˆ = g1,n (B) ˆ = The optimal solution of MAP is again given by gM,N (B). Initially, f1,n (B) L1

Pn

j=1 ATj

ˆ and −∞ otherwise. Additionally, fm,1 (B) ˆ = −∞ if F C1 + M C1 n ≤ B

ˆ < F Cm + M Cm , and fm,1 (B) ˆ = Lm AT1 for m = 1, 2, . . . , M , for m = 1, 2, . . . , M , B 12

ˆ ≥ F Cm + M Cm . Moreover, fm,n (B) ˆ = −∞ if F Cm + M Cm < B ˆ for m = 1, 2, . . ., B ˆ are found by the recursion n = 1, 2, . . . , N . Subsequent values of fm,n (B) ˆ = max fm,n (B)

   gm−1,n−1 (B ˆ −F Cm −M Cm ) + Lm ATn  ˆ − M Cm ) + Lm ATn }.  fm,n−1 (B

(3)

ˆ are found by the recursion Subsequent values of gm,n (B) ˆ = max{gm−1,n (B), ˆ fm,n (B)}. ˆ gm,n (B)

(4)

At each step of (4), either no passengers are assigned to class m, in which case the fixed cost of class m is not assessed against the budget, or at least one passenger is assigned to class m by (3). This dynamic programming algorithm runs in O(N M B) ˆ and fm,n (B) ˆ require O(N M B) space. When the dynamic time. The values gm,n (B) programming algorithm is complete, the number of passengers assigned to each class can be determined from iterating back from gM,N (B) and fM,N (B). Once the number of passengers assigned to each class is known, the passenger partitions are determined by Lemma 1.

3

Computational Results

This section provides computational results for MAP. The results incorporate data extracted from the Official Airline Guide (OAG) for the domestic flights of a single airline carrier at distinct stations in the United States. The data provided by the OAG includes the set of flights, the number of available seats on each flight, and the departure time of each flight. It is assumed that all passengers have exactly one checked and one carry-on bag. A total of 270 scenarios are considered, where these scenarios were designed using three passenger sets (i.e., the number of passengers), three assessed threat distributions, three types of classes, and ten budget values. The three passenger sets are defined based on data extracted from the OAG, which consider 10, 30, and 60 minute windows of time. To find the number of passengers in these time segments, passengers are assumed to arrive randomly according to a uniform distribution between 30 and 90 minutes prior to the departure time of each flight. This arrival interval is recommended by airlines for domestic flights (e.g., see www.nwa.com, www.ual.com, www.aa.com, and

13

www.delta.com). Moreover, each flight is assumed to have an enplanement rate of 80% (i.e., the number of passengers divided by the number of available seats). The data set is chosen based on finding the largest expected number of arriving passengers in 10, 30, and 60 minute windows, resulting in 1230, 3690, and 6200 passengers, respectively. The flights associated with each group of passengers can be identified and grouped together resulting in three subsets of flights for the different scenarios. The scenarios consider three hypothetical assessed threat value distributions based on information from the TSA. Initially, all passengers are assumed to be identical resulting in a degenerate distribution with all assessed values equal to one. This corresponds to the case when no information is known about the passengers (call this Type I). The next two assessed threat distributions are taken to be exponential distributions with means 1/8 and 1/16, respectively, that are truncated to allow only values less than one (Ross 2000). Call these two cases Type II and Type II, respectively. Note that the Type II and Type III assessed threat distributions result in approximately 80% of the passengers having assessed threat values less than 0.2 and 0.1, respectively. These assessed threat distributions model situation where few passengers are perceived to be potential risks, hence most passengers have low assessed threat values. Table 1 contains the security screening device data used for all the scenarios. It is divided into three areas: checked baggage, passenger, and carry-on baggage screening devices. The device values are estimated using information available in the public domain (Butler and Poole 2002; Virta et al. 2003). The yearly costs are computed based on the purchase costs, the expected lifetime of the device, and the yearly maintenance costs. In Table 1, the unadjusted fixed cost F C 0 is the fixed cost per hour per 1000 passengers, and it is based on the yearly fixed costs divided by the hours of operation per year (360 days a year, 6 peak hours per day), normalized by the capacity. Three cases are considered consisting of three, five, and eight classes. The threeclass scenarios are motivated by the TSA CAPPS II description, while allowing all passengers are allowed to board an aircraft (TSA 2003b). The five-class and eight-class scenarios correspond to environments with passengers of varying perceived risk levels using existing security screening devices. The marginal costs, fixed costs, and security level associated with each class for all three class scenarios are summarized in Table 2. The costs given are in (United States) dollars. These are computed from the values 14

Device Category Checked Baggage Passenger Carry-on Baggage

Table 1: Security device data False Device Type Clear FC0 EDS 0.12 4.167 Open Bag Trace (OT) 0.15 1.199 Metal Detector (MD) 0.30 0.051 Hand Wand Inspection (HW) 0.20 0.009 X-ray Machine (XR) 0.20 0.720 Detailed Hand Search (DHS) 0.20 0 Open Bag Trace/ Detailed Search (OTDS) 0.15 1.199

MC 1.00 0.83 0.28 1.25 0.28 1.25

Units/hour 125 28 90 20 90 20

1.29

18

associated with each the devices in each class and the number of passengers. The marginal costs are computed by summing the marginal costs of the devices used by the class. The fixed costs are computed by summing the fixed costs of the devices used by the class and scaling to account for the length of the time window and the number of passengers. The fixed cost associated with open trace is only assessed once, even if both types of open trace are used in the class. Furthermore, if there are M classes, then the fixed cost values are divided by M. This is done to compensate for the fact that not all passengers are screened by all devices and that some classes share security screening devices. The security levels for these examples are the overall true alarm rate, the probability that a threat is detected given that there is a threat. A passenger who is a threat is assumed to be detected if at least one security device gives an alarm response. Additionally, it is assumed that it is equally likely for a threat to be in a checked bag, carry-on bag, or on a person. This assumption is reasonable since no data exists that suggests a distribution among these means of attack. Each scenario is addressed using the 2GH implemented in Matlab. All the scenarios are also formulated as integer programming models (IPs) and solved using CPLEX 7.0. All the computational experiments were executed on a Pentium III 550 MHz processor with 1048 MB of RAM. Tables 3, 4, and 5 contain the 2GH and IP values for the scenarios, as well as the CPU times for the IPs. For each IP, CPLEX was halted after 170,000 CPU seconds (approximately 2 CPU days) if it had not found an optimal solution. This value is sufficiently long to give CPLEX a reasonable amount of time to solve the problems. If the IP was not solved to optimality, an asterisk (*) is listed

15

Class 1 2 3 1 2 3 4 5 1 2 3 4 5 6 7 8

Table 2: Security class costs and security levels Devices FC FC FC N=1230 N=3690 N=6200 EDS, MD, XR 67.49 202.47 340.19 EDS, MD, HW, XR DHS 67.62 202.85 340.83 EDS, OT, MD, HW, XR, OTDS 93.10 279.30 469.29 MD, XR 18.98 56.94 95.68 EDS, MD, XR 121.48 364.44 612.35 EDS, MD, XR, DHS 121.48 364.44 612.35 OT, MD, HW, XR, DHS 48.70 146.10 245.47 EDS, OT, MD, HW, XR, OTDS 167.58 502.74 844.72 MD, XR 23.73 71.18 119.60 MD, HW, XR 24.01 72.03 121.03 EDS, MD, XR 151.85 455.56 765.43 EDS, MD, HW, XR 151.85 455.56 765.43 EDS, MD, XR, DHS 152.14 456.41 766.87 OT, MD, HW, XR, DHS 60.87 182.62 306.84 OT, MD, HW, XR, OTDS 81.35 244.05 410.06 EDS, OT, MD, HW, XR, OTDS 209.48 628.43 1055.90

MC

L

1.56 2.81 4.93 0.56 1.56 2.81 2.64 4.93 0.56 1.81 1.56 2.81 2.81 3.89 3.93 4.93

0.793 0.927 0.964 0.500 0.793 0.847 0.917 0.964 0.500 0.580 0.793 0.847 0.873 0.917 0.920 0.964

as its IP value. Therefore, all the IP values listed are optimal values. All 90 threeclass scenarios finished in the allotted time, whereas 87 and 72 five-class and eight-class scenarios, respectively, finished in the allotted time. The Type II and Type III solutions always have larger objective function values than the corresponding Type I solution with the same number of passengers and budget value. This suggests that models that incorporate such information about passengers are more effective than models which assume that passengers are indistinguishable. For small budget values, the Type II and Type III solutions have significantly higher objective values than the corresponding Type I solution. As the budget increases, these differences become less pronounced, which suggests that when a large budget is available, it is less critical to distinguish between passengers (since nearly all passengers can then be assigned to the class with the highest (and most costly) security level). For all of the Type I IPs, the scenarios with indistinguishable passengers finished in under 2 CPU seconds regardless of the number of classes or the number of passengers. The Type II and Type III IPs took no less than 1.95 CPU seconds to complete. Of the 90 three-class IPs, 89 finished in less than one CPU hour, and 81 finished in less than one CPU minute. Of the 87 five-class IPs that finished, 74 finished in less than one CPU hour, and 47 finished in less than one CPU minute. Of the 72 eight-class IPs that 16

Table 3: Solutions for three-class scenarios N 1230 1230 1230 1230 1230 1230 1230 1230 1230 1230 3690 3690 3690 3690 3690 3690 3690 3690 3690 3690 6200 6200 6200 6200 6200 6200 6200 6200 6200 6200

B ($) 2202.47 2646.91 3091.36 3535.80 3980.25 4424.69 4869.14 5313.58 5758.03 6202.47 6407.41 7762.97 9118.52 10474.08 11829.63 13185.19 14540.74 15896.30 17251.85 18607.41 10720.57 13042.79 15365.01 17687.24 20009.46 22331.68 24653.90 26976.13 29298.35 31620.57

2GH value 0.8000 0.8388 0.8774 0.9162 0.9312 0.9375 0.9438 0.9501 0.9564 0.9627 0.7942 0.8336 0.8730 0.9124 0.9310 0.9374 0.9438 0.9503 0.9567 0.9631 0.7935 0.8336 0.8738 0.9139 0.9310 0.9376 0.9441 0.9507 0.9572 0.9637

Type I IP IP CPU value time (sec) 0.8000 1.33 0.8388 0.98 0.8774 1.00 0.9162 0.97 0.9312 1.03 0.9375 1.02 0.9438 0.97 0.9501 1.02 0.9564 0.98 0.9627 0.98 0.7942 1.06 0.8336 1.00 0.8730 1.00 0.9124 0.98 0.9310 1.00 0.9374 1.03 0.9438 1.03 0.9503 1.00 0.9567 0.97 0.9631 0.98 0.7935 1.05 0.8336 0.95 0.8738 1.02 0.9139 1.00 0.9310 1.03 0.9376 1.03 0.9441 1.02 0.9507 0.98 0.9572 1.05 0.9637 1.02

2GH value 0.8199 0.8894 0.9172 0.9266 0.9402 0.9511 0.9574 0.9612 0.9632 0.9640 0.7997 0.8827 0.9147 0.9262 0.9399 0.9508 0.9572 0.9612 0.9633 0.9640 0.7958 0.8822 0.9148 0.9263 0.9400 0.9509 0.9573 0.9613 0.9633 0.9640

17

Type II IP IP CPU value time (sec) 0.8199 2.39 0.8894 3.27 0.9176 18.9 0.9346 3.27 0.9458 2.70 0.9533 2.83 0.9583 2.92 0.9616 2.94 0.9633 2.28 0.9640 1.95 0.7997 8.78 0.8827 9.59 0.9158 8.95 0.9338 8.98 0.9453 9.63 0.9529 8.75 0.9581 10.6 0.9615 8.08 0.9633 9.83 0.9640 8.41 0.7958 33.9 0.8822 47.8 0.9148 73.1 0.9333 226.5 0.9451 67.0 0.9529 61.3 0.9582 67.3 0.9616 54.3 0.9634 61.0 0.9640 31.2

2GH value 0.8192 0.8868 0.9161 0.9265 0.9399 0.9504 0.9569 0.9609 0.9631 0.9640 0.7998 0.8819 0.9143 0.9262 0.9398 0.9506 0.9571 0.9611 0.9632 0.9640 0.7960 0.8814 0.9145 0.9263 0.9399 0.9506 0.9572 0.9612 0.9633 0.9640

Type III IP IP CPU value time (sec) 0.8192 2.16 0.8868 3.14 0.9161 32.2 0.9335 5.45 0.9447 3.16 0.9525 3.05 0.9578 2.94 0.9612 2.92 0.9632 2.38 0.9640 2.17 0.7998 8.52 0.8819 13.1 0.9155 9.37 0.9334 12.2 0.9448 8.84 0.9526 10.1 0.9580 10.4 0.9614 10.5 0.9633 8.63 0.9640 8.19 0.7960 7359 0.8814 105 0.9145 75.2 0.9330 45.2 0.9447 35.6 0.9527 30.8 0.9581 33.9 0.9615 31.6 0.9634 24.0 0.9640 12.9

Table 4: Solutions for five-class scenarios

N 1230 1230 1230 1230 1230 1230 1230 1230 1230 1230 3690 3690 3690 3690 3690 3690 3690 3690 3690 3690 6200 6200 6200 6200 6200 6200 6200 6200 6200 6200

B ($) 800 1400 2000 2600 3200 3800 4400 5000 5600 6200 2400 4200 6000 7800 9600 11400 13200 15000 16800 18600 4000 7033.33 10066.67 13100 16133.33 19166.67 22200 25233.33 28266.67 31300

2GH value 0.5068 0.6358 0.7787 0.8407 0.8980 0.9226 0.9326 0.9426 0.9526 0.9626 0.5070 0.6359 0.7789 0.8407 0.8982 0.9226 0.9326 0.9426 0.9526 0.9626 0.5060 0.6348 0.7782 0.8406 0.8984 0.9227 0.9327 0.9427 0.9528 0.9628


2GH value 0.5326 0.7534 0.8524 0.9005 0.9166 0.9344 0.9503 0.9585 0.9626 0.9640 0.5347 0.7515 0.8504 0.8997 0.9166 0.9345 0.9500 0.9583 0.9626 0.9640 0.5307 0.7492 0.8488 0.8991 0.9166 0.9346 0.9499 0.9583 0.9626 0.9640

18

Type II IP IP CPU value time (sec) 0.5326 10648 0.7534 86201 0.8524 3214 0.9005 139 0.9222 190 0.9406 19.6 0.9522 17.6 0.9591 1555 0.9627 286 0.9640 6.42 0.5347 6618 0.7515 159 0.8504 240 0.8997 157692 0.9219 158 0.9404 51.1 0.9519 130 0.9589 1310 0.9626 29.9 0.9640 14.9 0.5307 6934 * * 0.8991 78617 0.9216 153615 0.9402 117 0.9517 91.1 0.9588 85.3 0.9626 86.8 0.9640 35.7

2GH value 0.5328 0.7456 0.8471 0.8982 0.9165 0.9340 0.9494 0.9580 0.9624 0.9640 0.5350 0.7485 0.8492 0.8988 0.9165 0.9344 0.9497 0.9582 0.9625 0.9640 0.5310 0.7462 0.8478 0.8985 0.9165 0.9344 0.9497 0.9582 0.9625 0.9640

Type III IP IP CPU value time (sec) 0.5328 16884 0.7456 79460 0.8471 19554 0.8983 43.7 0.9206 16.7 0.9396 8.19 0.9513 26.8 0.9585 6.7 0.9625 5.6 0.9640 3.14 0.5350 3597 0.7485 469 0.8492 808 0.8988 84619 0.9213 519 0.9398 126 0.9515 109 0.9587 1029 0.9625 35.8 0.9640 10.3 0.5310 16624 0.7462 1165 0.8478 4233 * 0.9211 353.8 0.9397 128.2 0.9514 112.2 0.9586 114.8 0.9625 86.6 0.9640 27.8

Table 5: Solutions for eight-class scenarios N 1230 1230 1230 1230 1230 1230 1230 1230 1230 1230 3690 3690 3690 3690 3690 3690 3690 3690 3690 3690 6200 6200 6200 6200 6200 6200 6200 6200 6200 6200

B ($) 800 1400 2000 2600 3200 3800 4400 5000 5600 6200 2500 4300 6100 7900 9700 11500 13300 15100 16900 18700 4000.00 7055.56 10111.11 13166.67 16222.22 19277.78 22333.33 25388.89 28444.44 31500.00

2GH value 0.5033 0.6274 0.7704 0.8133 0.8438 0.8773 0.8972 0.9200 0.9370 0.9590 0.5060 0.6355 0.7784 0.8147 0.8456 0.8784 0.8984 0.9200 0.9382 0.9603 0.5030 0.6275 0.7719 0.8138 0.8448 0.8781 0.8983 0.9200 0.9386 0.9609


2GH value 0.5133 0.7364 0.7930 0.8503 0.8891 0.9205 0.9405 0.9534 0.9606 0.9639 0.5305 0.7410 0.7947 0.8528 0.8908 0.9207 0.9406 0.9535 0.9608 0.9640 0.5126 0.7338 0.7922 0.8510 0.8895 0.9197 0.9400 0.9532 0.9608 0.9640

19

Type II IP IP CPU value time (sec) * 0.7364 114570 0.8135 740.9 0.8611 132.2 0.8968 2074.6 0.9233 133.4 0.9417 4547.8 0.9538 21.64 0.9606 1075.4 0.9639 7.28 * 0.7410 128020 * * 0.8974 732.1 * * 0.9538 2730.6 0.9608 107475 0.9640 26.05 0.5126 1445.6 0.7338 799.2 * * * 0.9225 7918.8 0.9411 3596.7 * 0.9608 14360 0.9640 57.97

2GH value 0.5134 0.7320 0.7921 0.8487 0.8863 0.9173 0.9385 0.9521 0.9602 0.9639 0.5308 0.7401 0.7932 0.8521 0.8896 0.9197 0.9401 0.9531 0.9606 0.9640 0.5126 0.7328 0.7922 0.8502 0.8882 0.9189 0.9397 0.9529 0.9606 0.9640

Type III IP IP CPU value time (sec) * 0.7320 14505 0.8105 2053.9 0.8578 197.4 0.8927 59.03 0.9203 46.9 0.9397 276.7 0.9525 47.91 0.9602 274.4 0.9639 8.19 * * 0.8153 83785 0.8608 4852 0.8958 102.3 0.9225 3945 0.9412 1793.5 0.9533 2285.1 * 0.9640 32.52 * 0.7328 989.8 * * 0.8944 8634.0 * 0.9407 6889.5 0.9532 1272.5 0.9606 1321.0 0.9640 108.3

Table 6: Average 2GH CPU times (seconds) M 3 3 3 5 5 5 8 8 8

N 1230 3690 6200 1230 3690 6200 1230 3690 6200

Type I 0.0314 0.0954 0.140 0.0640 0.186 0.303 0.144 0.438 0.719

Type II 0.0328 0.0892 0.140 0.0672 0.183 0.305 0.147 0.434 0.727

Type III 0.0343 0.0923 0.148 0.0625 0.181 0.308 0.148 0.436 0.727

finished, 60 finished in less than one CPU hour and 39 finished in less than one CPU minute. In general, the IPs with relatively small budget values took longer to solve, while the IPs that had larger budget values took the least amount of computing time, particularly when the budgets were large enough to assign nearly all passengers to the class with the highest security level. In all 90 Type I scenarios and in 34 of 78 (finished) Type II and 33 of 81 (finished) Type III scenarios, the 2GH solution is identical to the optimal solution. The scenarios where the 2GH value and the IP value matched are in boldface in Tables 3, 4, and 5. Typically, scenarios with either small or large budget values had the same 2GH and IP values, where the optimal solutions used two classes. When the 2GH and IP values were different, the IP solutions never used more than three classes. Table 6 contains the average CPU time to execute 2GH for each of the sets of scenarios. All of the average 2GH CPU times for a given number of classes, number of passengers, and assessed threat distribution are less than 0.73 CPU seconds, with the 2GH never taking longer than 1.3 CPU seconds to identify a single approximate solution. Moreover, for a given number of classes and passengers, the 2GH CPU time remained approximately the same across the Type I, II, and III assessed threat distributions. This can be contrasted to the corresponding IPs, which were solved quickly for Type I scenarios, and generally took longer for the Type II and III scenarios. The quality of the 2GH solutions can be measured by the relative effectiveness measure Γ=

z h − z0 . z − z0

where z h is the 2GH solution objective function value, z0 is the worst possible feasible

20

solution objective function value, and z is the optimal solution objective function value. If the relative effectiveness measure is one, then 2GH obtains an optimal solution, while if is zero, then 2GH obtains the worst possible feasible solution. Figures 1, 2, and 3 depict the relative effectiveness measure of the 2GH solutions for the the three-class, five-class, and eight-class scenarios, respectively. Several relative effective measure values could not be computed for the five-class and eight-class solutions since their corresponding IPs did not finish in the allotted time, hence several points are missing from Figures 2 and 3. Note that the Type I scenarios are omitted since the relative effectiveness measures for these scenarios are all one. The Type II and Type III scenarios often have relative effectiveness measures of one when the budget was either small or large. The relative effectiveness measure is never less than 0.943 for the three-class scenarios, 0.986 for the five-class scenarios, and 0.930 for the eight-class scenarios, which indicates that the 2GH solutions are close to the optimal values when using just two classes.

Relative Effectiveness Measure

N=1230

N=3690

N=6200

1.02

1.02

1.02

1.01

1.01

1.01

1

1

1

0.99

0.99

0.99

0.98

0.98

0.98

0.97

0.97

0.97

0.96

0.96

0.96

0.95

0.95

0.95

0.94

0.94

0.94

0.93

0.93

0.93

Type II Type III 0.92 2000

4000 Budget ($)

6000

Type II Type III 0.92 0.5

1 1.5 Budget ($)

Type II Type III 2 4

x 10

0.92

1

2 Budget ($)

Figure 1: Relative effectiveness measure for three-class examples

21

3 4

x 10


N=1230

N=3690

N=6200

1.005

1.005

1.005

1

1

1

0.995

0.995

0.995

0.99

0.99

0.99

0.985

0.985

0.985

Type II Type III 0.98

2000

4000 6000 Budget ($)


0.5

1 1.5 2 4 Budget ($) x 10


1 2 Budget ($)

3 4

x 10

Figure 2: Relative effectiveness measure for five-class examples

4

Conclusions

Passenger and baggage screening is a critical component of any aviation security system operation. This paper introduces the Multilevel Allocation Problem, a framework to model passenger and baggage screening systems. MAP models each security class in terms of its marginal and fixed costs, and security level, where passenger assignment and budget constraints must be satisfied. MAP is formulated as an integer programming model. MAP is shown to be NP-hard, and two dynamic programming algorithms that solve MAP in O(N 2 M B) and O(N M B) time and O(N M B) space are presented. Furthermore, the Two Class Greedy Heuristic (2GH) is introduced to obtain approximate solutions to MAP in O(M 2 N ) time with an additional O(N log N ) time for the initial sorting of passengers. Data extracted from the Official Airline Guide (OAG) and hypothetical data based on information provided by the TSA was used to construct a total of 270 scenarios for MAP. The optimal (IP) and 2GH objective function values were computed for each of these scenarios, where twenty-one of the IPs did not terminate with an optimal 22


N=1230

N=3690

N=6200

1.02

1.02

1.02

1

1

1

0.98

0.98

0.98

0.96

0.96

0.96

0.94

0.94

0.94

0.92

Type II Type III 2000 4000 Budget ($)

0.92

6000


1 1.5 2 4 Budget ($) x 10

0.92

Type II Type III 1 2 Budget ($)

3 4

x 10

Figure 3: Relative effectiveness measure for eight-class examples solution in the allotted computing time (three of which are five-class scenarios and eighteen of which are eight-class scenarios). In many cases, 2GH obtained the optimal solution value, including all of the Type I scenarios, 34 of the 78 (completed) Type II scenarios, and 33 of the 81 (completed) Type III scenarios. The relative effectiveness measures for the 2GH are greater than 0.940 in the three-class scenarios, 0.986 for the five-class scenarios, and greater than 0.930 for the eight-class scenarios. One limitation of the 2GH is that it obtains solutions that use no more than two classes. However, the optimal solutions for all of the Type I scenarios use two classes, and none of the completed optimal solutions for the Type II and Type III scenarios use more than three classes. This suggests that even when many classes are available, it may be more effective (from a security standpoint) to use fewer classes. This implication is desirable on a practical level since security personnel need to be trained to be fluent with fewer security procedures. Therefore, any security system design that is simple to implement and easy operate is of added value. There are several possible directions to extend the research results presented. First,

23

minimizing the overall false alarm rate is of interest because the majority of passengers are not threats, and high false alarm rates are costly for the airlines. This objective suggests the development of the Multicriteria MAP, which simultaneously maximizes the overall true alarm rate and minimizes the overall false alarm rate. Second, the Dynamic MAP, a variation of MAP in which passengers arrive dynamically can be formulated, and algorithms for effectively assigning passengers to classes in real-time would need to be obtained. Another model for passenger and baggage prescreening considers classes after the budget has been used to purchase security devices and hire security personnel. In this case, each class is defined in terms of its associated devices and their capacities, though costs are not included in such a model and the objective is to assign passengers to classes so that the total security is maximized while all devices are operating within their capacities. Work is in progress to design algorithms and heuristics for all these models.

Acknowledgements This research was supported in part by the National Science Foundation (DMI-0114046, DMI-0114499) and the Air Force Office of Scientific Research (FA9550-04-1-0110). The first author was supported in part by the program in Arms Control, Disarmament, and International Security at the University of Illinois in Urbana-Champaign. The computational work was done in the Simulation and Optimization Laboratory housed within the Department of Mechanical and Industrial Engineering at the University of Illinois. The authors would like to thank Dr. Lyle Malotky, Mr. Michael McCormick and Dr. John Nestor of the Transportation Security Administration, Department of Homeland Security, for their guidance and feedback on the research results reported in this paper.

References A. Barnett, “The Worst Day Ever,” OR/MS Today 28, 28-31 (2001). A. Barnett, “CAPPS II: The Foundation of Aviation Security?” Risk Analysis, to appear (2004). A. Barnett, M. Abraham, and V. Schimmel, “Airline Safety: Some Empirical Find24

ings,” Management Science 25, 1045-1056 (1979). A. Barnett, and M. K. Higgins, “Airline Safety: The Last Decade,” Management Science 35, 1-21 (1989). A. Barnett, R. W. Shumsky, M. Hansen, A. Odoni, and G. Gosling, “Safe at Home? An Experiment in Domestic Airline Security,” Operations Research 49, 181-195 (2001). R. A. Brualdi, Introductory Combinatorics (3rd ed.), Prentice Hall, Upper Saddle River, NJ (1999). V. Butler and R. W. Poole Jr., “Rethinking Checked-Baggage Screening,” Reason Public Policy Institite, Policy Study No. 297., Los Angeles, CA (2002). S. Chakrabarti and A. Strauss, “Carnival Booth: An Algorithm for Defeating the Computer-Aided Passenger Screening System.” First Monday 7, (2002), (available at www.firstmonday.org). FAA, “FAA Forecast Continued Drop in Air Traffic This Year, Strong Recovery in 2003,” Report, Federal Aviation Administration, Washington, D. C. (2002). Hall and DeLollis, “Plan to collect flier data canceled.” USA Today, 1 (July 14, 2004). G. H. Hardy, J. E. Littlewood, and G. Polya, Inequalities. Cambridge University Press, Cambridge, England (1934). J. Hilkevitch, “London airport offers security lessons for U.S.” Chicago Tribune, 1 (February 17, 2003). S. H. Jacobson, J. M. Bowman, and J. E. Kobza, “Modeling and Analyzing the Performance of Aviation Security Systems using Baggage Value Performance Measures,” IMA Journal of Management Mathematics 12, 3-22 (2001). S. H. Jacobson, L. A. McLay, J. E. Kobza, and J. M. Bowman, “Modeling and Analyzing Multiple Station Baggage Screening Security System Performance.” Naval Research Logistics, to appear (2005). S. H. Jacobson, J. E. Virta, J. M. Bowman, J. E. Kobza, and J. J., Nestor, “Modeling Aviation Baggage Screening Security Systems: A Case Study.” IIE Transactions 35, 259-269 (2003). 25

G. S. Lueker, “Two NP-Complete Problems in Nonnegative Integer Programming.” Technical Report No. 178, Computer Science Laboratory, Princeton University, Princeton, NJ (1975). L. O. Malotky, “Introduction to the Sixth International Civil Aviation Security Conference,” Journal of Testing and Evaluation 22, 235-237 (1994). S. Martonosi, and A. I. Barnett, “Security Profiling of Airline Passengers: How Effective Would It Be?” presented at the INFORMS National Meeting, Atlanta, GA (2003). L. A. McLay, and S. H. Jacobson, “Integer Knapsack Problems with Set-up Weights,” Technical Report, Department of Mechanical and Industrial Engineering, University of Illinois, Urbana, IL (2003). K. M. Mead, “Key Challenges Facing the Transportation Security Administration,” Office of the Inspector General Report Number CC-2002-180, Department of Transportation, Washington, D. C. (2002). K. M. Mead, “Aviation Security Costs, Transportation Security Administration,” Office of the Inspector General Report Number CC-2003-066, Department of Transportation, Washington, D. C. (2003). National Research Council, Airline Passenger Security Screening, National Academy Press Publication NMAB-482-1, Washington, D.C. (1996). R. W. Poole Jr. and G. Passantino, “A Risk-Based Airport Security Policy,” Reason Public Policy Institute, Policy Study No. 308., Los Angeles, CA (2003). S. M. Ross, Introduction to Probability Models (7th ed.) Harcourt Academic Press, San Diego, CA, 591-595 (2000). Singer, “Life after death for CAPPS II?.” Wired News, (2004) (available at www.wired.com). TSA, Personal Communications, TSA Briefing, October 3, 2003, Arlington, VA (2003a). TSA, “TSA’s CAPPS II Gives Equal Weight to Privacy, Security,” Press Release, United States Department of Homeland Security, Washington, D. C. (2003b).

26

J. E. Virta, S. H. Jacobson, and J. E. Kobza, “Outgoing Selectee Rates at Hub Airports,” Reliability Engineering and System Safety 76, 155-165 (2002). J. E. Virta, S. H. Jacobson, and J. E. Kobza, “Analyzing the Cost of Screening Selectee and Non-Selectee Baggage,” Risk Analysis 23, 897-908 (2003).

Appendix Proof of Theorem 1: MAP is shown to be NP-hard by constructing a polynomial Turing reduction from the Integer Knapsack Problem (IKP) (Lueker 1975). The objective of IKP is to choose the number of each item type to add to the knapsack such that the knapsack is within its capacity and the total profit is maximized. IKP is first formally stated. Integer Knapsack Problem (IKP) Given a total of m item types, with weights w1 , w2 , . . . , wm , profits, p1 , p2 , . . . , pm , and knapsack capacity, c, assign nonnegative integers u1 , u2 , . . . , um to the m objects such P Pm that m i=1 ui wi ≤ c and i=1 ui pi is maximized. Given an arbitrary instance of the IKP, construct a particular instance of MAP. Without loss of generality, assume that w1 ≤ wi for i = 2, 3, . . . , m. For simplification, let p¯ =

Pm

i=1 pi .

Then any arbitrary instance of IKP can be formulated as a particular

instance of MAP as follows: M = m + 1 classes, N = bc/w1 c passengers, budget B = c, the security level of each class Li = pi /¯ p for i = 1, 2, . . . , m, Lm+1 = 0, marginal costs M Ci = wi for i = 1, 2, . . . , m, M Cm+1 = 0, F Ci = 0 for i = 1, 2, . . . , m + 1, and ATj = 1/N for j = 1, 2, . . . , N (i.e., passengers are indistinguishable). Note that 0 ≤ Li ≤ 1 for i = 1, 2, . . . , m + 1. This reduction requires O(m + bc/w1 c) time and O(m) space. To show that an optimal solution to MAP maps to an optimal solution of IKP, suppose that A∗1 , A∗2 , . . . , A∗m+1 is an optimal solution to MAP. Note that A∗1 , A∗2 , . . . , A∗m+1 are mutually exclusive and exhaustive subsets of {1,2,. . . ,N }, the budget constraint is satisfied (i.e.,

Pm+1 i=1

M Ci |A∗i | ≤ B), and the total security is maximized (i.e.,

Pm+1 i=1

Li |A∗i |).

The claim is that u∗1 = |A∗1 |, u∗2 = |A∗2 |, . . . , u∗m = |A∗m | is an optimal solution to IKP. Since wi = M Ci and pi = (1/¯ p) Li , i = 1, 2, . . . , m, M Cm+1 = Lm+1 = 0, and c = B, then u∗2 , u∗1 , . . . , u∗m is a feasible solution to IKP (i.e.,

27

Pm

∗ i=1 wi ui

≤ c) with objective

function value

Pm+1 i=1

Li |A∗i | = (1/¯ p)

Pm

∗ i=1 pi ui .

Suppose that u ¯1 , u ¯2 , . . . , u ¯m is an optimal solution to IKP such that Pm

∗ i=1 pi ui .

Pm

¯i i=1 pi u

Then |A¯1 | = u ¯1 , |A¯2 | = u ¯2 , . . . , |A¯m | = u ¯m and |A¯m+1 | = N −

is a feasible solution to MAP. To see this, note that

PM

>

Pm

¯i i=1 u

¯ = N , hence, mutually

i=1 |Ai |

exclusive and exhaustive passenger assignment subsets exist. Since u¯1 , u ¯2 , . . . , u ¯m is a feasible solution to IKP, then m+1 X

M Ci |A¯i | =

i=1

m X

M Ci |A¯i | =

i=1

m X

wi u ¯i ≤ c = B,

i=1

P Pm ¯ and A¯1 , A¯2 , . . . , A¯m+1 is a feasible solution to MAP. Since p¯ m+1 ¯i , i=1 pi u i=1 Li |Ai | =

then m X

and

pi u∗i = p¯

i=1 Pm ¯i i=1 pi u

>

m+1 X

Li |A∗i | ≥ P

i=1 Pm ∗ i=1 pi ui ,

m+1 X

Li |A¯i | =

i=1

m X

pi u ¯i .

i=1

which is a contradiction. Therefore, u∗1 = |A∗1 |, u∗2 =

|A∗2 |, . . . , u∗m = |A∗m | is an optimal solution to IKP.

2

Proof of Lemma 1: Let lk , k = 1, 2, . . . , N be the security level of the class passenger k is assigned to and ni = |{k|lk = Li }| for i = 1, 2, . . . , M be the number of passengers assign to class i. Since N is in general much larger than M, each security level value may be duplicated many times. For example, if there are fifty passengers and two classes with L1 = 0.5 and L2 = 0.9, and the first forty passengers are assigned to class 1, then l1 = l2 = ... = l40 = 0.5 and l41 = l42 = ... = l50 = 0.9. The MAP objective with passenger assignments A1 , A2 , . . . , AM is PN

1

M X X

j=1 ATj i=1 j∈Ai

Li ATj = PN

1

N X

j=1 ATj j=1

lj ATj .

The proof follows from Hardy’s Lemma (Hardy et al. 1934), which states that if x1 ≤ x2 ≤ . . . ≤ xn and y1 ≤ y2 ≤ . . . ≤ yn are sequences of numbers, then max(i1 ,i2 ,...,in )∈P

n X j=1

xij yj =

n X

xj yj ,

j=1

where P is the set of all permutations of the integers (1, 2, . . . , n). 2

28

Proof of Lemma 2: An enumeration algorithm considers all possible passenger assignments and returns the feasible solution with the best objective function value. Since each of the N passengers can be assigned to each of the M classes, then this enumeration algorithm considers M N total passenger assignments. However, consider a modified enumeration algorithm for solving MAP which uses Lemma 1 to limit the number of passenger assignments considered. Lemma 1 indicates how to assign individual passengers to classes once the number of passengers assigned to each class is known. Therefore, the total number of passenger assignments to consider is a “combination of multisets” (Brualdi 1999), 



(N + M − 1)(N + M − 2) · · · (N + 1)  N +M −1  = O(N M −1 ).  = (M − 1)!

N

Since O(N) time is required to assign individual passengers to classes and to determine the objective function value, then this modified enumeration algorithm requires O(N M ) time, hence, is polynomial in terms of the number of passengers N for a fixed number of classes M.

2

Proof of Lemma 3: For M = 2 classes, 2GH executes in O(N ) time with an additional O(N log N ) time for the initial sort. Without loss of generality, it is assumed that L1 ≤ L2 and that at least +

one class is in C N , hence a feasible solution exists. In order to determine whether 2GH finds an optimal solution, two cases are considered: 1) class 2 is in C N is in C N

+

+

and 2) class 1

−

and class 2 is in C N . +

When class 2 is in C N , 2GH finds the optimal solution when it considers the best solution using one class. In this case, the heuristic value is identical to the optimal objective function value of L2 . When class 1 is in C N

+

−

and class 2 is in C N , then the best solution using exactly

one class that 2GH obtains is L1 . Then, 2GH considers solutions using both classes, which leads to solving the following linear equations, M C1 n1 + M C2 n2 = B − F C1 − F C2 , n1 + n2 = N. 29

If n2 ≤ 0, then there is no feasible solution using both classes and L1 is the optimal solution value. If 0 < n2 < N , an integer feasible solution is created by adding dn1 e and bn2 c passengers to class 1 and class 2, respectively. Therefore, dn1 e and bn2 c are the optimal number of passengers to assign to class 1 and class 2, respectively. Secondly, Lemma 1 indicates that the optimal way to assign bn2 c passengers to the class with the higher security level is to choose the bn2 c passengers with the highest assessed threat values, which is how the 2GH assigns passengers to class 2. Since both 2GH and the optimal solutions assign the same set of passengers to class 2, then the solutions are identical.

2

Proof of Theorem 2: When all of the passengers have identical assessed threat values, then the particular instance of MAP can be formulated as an instance of the k -item Integer Knapsack Problem with Set-up Weights (k IKPSW) (McLay and Jacobson 2003). The Integer Knapsack Problem with Set-up Weights (k IKPSW) Given a total of m types of items, with each type of item having positive integer weight w1 , w2 , . . . , wm , nonnegative integer set-up weight s1 , s2 , . . . , sm , nonnegative value v1 , v2 , . . . , vm , knapsack capacity c, and cardinality k, find nonnegative integers P Pm P Pm x1 , x2 , . . . , xm such that m i=1 xi = k, i=1 wi xi + i:xi >0 si ≤ c, and i=1 vi xi is maximized. The particular instance of MAP is equivalent to k IKPSW with m = M , k = N , c = B, wi = M Ci , i = 1, 2, . . . , m, si = F Ci , i = 1, 2, . . . , m, and vi = Li /

PN

j=1 ATj ,

i=

1, 2, . . . , m. 1/2

The k IKPSW Greedy Heuristic, Hk , finds the best solution using no more than two item types, where such solutions are always within at least 1/2 of the optimal solution 1/2

value (McLay and Jacobson 2003). 2GH is the same as Hk identical assessed threat values.

when the passengers have 2

30